← D-TRUST cases
Bugzilla #2056882
Ca Certificate Compliance
Certificate Misissuance
Externally Reported Incident
Problem Reporting Failure
D-TRUST EV subordinate CA missing required cabfOrganizationIdentifier extension
UNCONFIRMED
D-TRUST
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns a Certificate Problem Report about the subordinate CA certificate "D-TRUST EV CA 2-23-2 2023." D-TRUST confirmed that the certificate contains subject:organizationIdentifier (VATDE-202620438) without the required cabfOrganizationIdentifier extension, which it says violated the EV Guidelines in effect at issuance. D-TRUST stated that the subordinate CA has never issued subscriber certificates and that the only certificate issued from it was a delegated OCSP responder certificate for its own revocation status service. The company also said that no subscriber or relying party is impacted. The report was disclosed as a third-party reported incident.
Chronology
- Subordinate CA certificate issued without the required cabfOrganizationIdentifier extension.
- A Certificate Problem Report was received about the subordinate CA certificate.
Thread Activity
- D-Trust — D-TRUST filed a preliminary incident report confirming the missing cabfOrganizationIdentifier extension and stating the issue was third-party reported.
Participants
D-Trust
External References
Similar Local Cases
D-Trust: TLS Precertificates Exceeding the Maximum Validity Period Allowed by the TLS Baseline Requirements
D-Trust: issuing 1024 bit certificates
Disig: CP/CPS misstatement regarding Key Usage criticality for TLS certificates
QuoVadis: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy or the BRs
GlobalSign: EV certificates with serialNumber Government Entity and businessCategory Private Organization
GlobalSign: Certificate issued to FQDN with malformed CAA
GlobalSign: OCSP responder certificates with more than 64 characters in CN
GlobalSign: Issuance of test certificate (pre-certificate) for EV SSL/QWAC with no EKU extension